WordPress plugin delivery through GitHub releases

Run a cleaner plugin delivery channel from GitHub.

Git Repos Manager lets WordPress admins discover repositories tagged with wp-plugin, install release ZIP assets through the native upgrader, and selectively track active plugins for update checks.

At a glance Git plugin delivery signals
wp-pluginTopic-based discovery
PATPrivate repo support
NativeWP upgrader install flow
CachedLockout and force-check tools
WordPress 6.0+ PHP 8.1+ Public and private repo support
Release-ready Native updater Private-safe

Example admin view for Available Plugins.

The interface works better as a standalone product preview than as a cramped hero aside. This gives the repository list, install actions, and source-profile controls enough horizontal room to read cleanly.

Example admin view -> Available Plugins

A WordPress-native admin screen for browsing eligible repositories, resolving release assets, and deciding which plugins should participate in ongoing update checks.

Repository table
enterprise-api-importerLatest published release includes ZIP asset
release
Active
Install Now
enterprise-cptEligible repository with release notes
ready
Idle
Install Now
private-client-pluginAuthenticated download path resolved
private
Active
Update
Source profiles
Public source
target: tporret
pat: optional when repos are public
Private source
target: client-org
pat: used for private release assets
Controls
cache: 12h
lockout: 1h on rate limit
Repository requirements
Tag the repo Add the wp-plugin topic so discovery stays intentional.
Publish a release Create a GitHub release the plugin can resolve during install and update checks.
Attach a ZIP asset Use a real .zip release asset with the expected content type.
Add PATs only where needed Private repositories can be unlocked per source instead of through one global token.

A repo-backed plugin workflow that stays native to WordPress.

This product keeps GitHub as the source of truth without forcing admins into a foreign interface. Discovery, installation, release metadata, authenticated downloads, and update checks all stay inside WordPress conventions.

Discovery by topic

Repositories only appear when they are explicitly tagged with wp-plugin, which keeps the plugin list intentional instead of dumping every repo in an org.

Native install flow

Release ZIP assets are installed through the WordPress upgrader stack, so the experience stays familiar to admins and compatible with core plugin handling.

Active repo tracking

Admins can mark repositories active for update checks, so only approved plugins participate in the GitHub-backed update lifecycle.

Private repo support

Per-source PATs unlock private repositories and authenticated asset downloads, with token resolution matched by repository owner instead of one global credential.

Cache and lockout controls

Repository and release payloads are cached, a rate-limit lockout prevents thrashing the API, and the settings page exposes a force-check utility when you need fresh data now.

Operational clarity

Auth failures, missing releases, bad ZIP assets, and not-found responses are surfaced with explicit admin-facing error messages instead of silent failure modes.

Connect sources first. Distribute plugins second.

The setup flow is straightforward, but the product stays opinionated where it matters: source-level credentials, topic filtering, release asset validation, and explicit active-repo selection.

01
Open Git Plugins -> Settings

Add one or more GitHub user or organization targets. Each source can carry its own optional PAT.

02
Publish your repository correctly

Use the wp-plugin topic, create a release, and attach a real .zip asset.

03
Review Available Plugins

The plugin builds a clean list of eligible repositories, latest versions, install actions, and active toggles.

04
Force fresh checks when needed

Flush caches and trigger update checks from the settings page when a release just shipped and you need the admin to reflect it immediately.

Settings page

Repeatable source rows

Each source stores a target name and optional PAT. That makes public orgs, private client repos, and mixed environments manageable without awkward credential reuse.

Repository rules

Release asset discipline

The installer prefers ZIP assets from the latest published release and falls back carefully, which means your release process stays explicit and auditable.

WordPress fit

Admin-native install actions

Install, uninstall, active-state saving, settings notices, and update integration all sit inside WordPress conventions instead of bolted-on custom flows.

Private delivery

Owner-matched token lookup

The plugin resolves a token per repository owner, which is the right mental model when one admin instance needs to talk to multiple GitHub accounts or orgs.

From GitHub release to WordPress update notice.

The product story here is operational confidence: discover repos, install from release assets, keep selected plugins active for checks, and let WordPress core surface version changes in a familiar way.

Release handling
01
Fetch repository list

Query configured users or orgs and filter down to repos that explicitly declare themselves as WordPress plugins.

cached
02
Resolve latest release

Pull the newest published release, fall back to release lists when needed, and reject incomplete release metadata.

release
03
Install ZIP asset

Use the native upgrader and inject GitHub auth headers only for approved GitHub asset hosts when private downloads are involved.

native
04
Track active repos

Only repositories marked active are included in ongoing update checks, which keeps governance explicit for site owners.

tracked
Timestamp Event Source
09:12:04 Repository list cached from client-org after topic filter matched 4 plugin repos. api
09:12:06 Latest published release found for tporret/enterprise-api-importer with valid ZIP asset. release
09:12:08 Private download authenticated with owner-matched PAT and handed off to WordPress upgrader. install
09:12:10 Update check injected into core plugin updates for repositories currently marked active. update

Built for admins who need predictable behavior, not magic.

The strongest part of the product is restraint. It narrows discovery, validates releases, scopes credentials by source, and handles bad API states explicitly.

Rate limits

One-hour lockout

When GitHub rate limiting is detected, requests pause instead of hammering the API. That protects both reliability and operator sanity.

Token safety

Host-restricted auth injection

Authorization headers are only injected for allowed GitHub hosts and asset endpoints, which reduces accidental credential leakage paths.

Errors that explain themselves

Useful admin notices

Missing releases, invalid repo names, auth failures, and transport problems surface as actionable WordPress notices instead of vague silent breakage.

Turn GitHub releases into a real plugin channel.

Git Repos Manager is for teams that want WordPress-native installs and updates without giving up GitHub as the source of truth for plugin distribution.

WordPress 6.0+ PHP 8.1+ GitHub Releases Private repo PAT support GPLv2 or later